🛡️ Security Checks for Websites

The scanner comprehensively examines websites, domains and infrastructure with proprietary analysis software:

• Website/domain scan
• Software scan (frontend & backend)
• DNS & email checks
• Web server checks (CSP, ...)
• Hosting, provider and CDN indication
• Form checks
• XSS checks
• Accessibility checks, global and page by page
• Cookie table
• Detailed report with findings and guidance

🖥️ Software & infrastructure scan: Frontend and backend are checked for outdated libraries, insecure dependencies and known vulnerabilities in the technologies in use.

🌐 URL reputation & abuse check: The domain is compared against known blacklists and abuse databases to detect phishing entries, malware associations or a poor spam reputation early.

🛡️ Web server check: Security-relevant HTTP headers are analysed, including Content Security Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options and other protection mechanisms against common attack vectors.

📡 DNS checks & email security: DNS configuration and email security protocols such as SPF, DKIM and DMARC are checked to prevent spoofing and unauthorised email sending in the name of your domain.

🏠 Hosting & domain analysis: The hosting environment, IP reputation, ASN assignment and domain registration data are examined for anomalies.

🔓 CVE vulnerability check: The software components in use are compared against the public CVE database, so that known and already documented security flaws are reliably identified.

📝 Form checks: Forms are checked for insecure transmission, missing CSRF protection and insufficient input validation.

⚠️ XSS security checks: The page is tested for cross-site scripting vulnerabilities, a common attack vector in which malicious code can be injected into other users' browsers.

🍪 Cookie check + LocalStorage & SessionStorage: Cookies are checked for secure flags (HttpOnly, Secure, SameSite). In addition, we analyse whether sensitive data is stored unprotected in browser storage.

📋 WCAG checks & best practices: The analysis tests your website for compliance with the current WCAG guidelines (including newer versions) and established accessibility best practices, from correct semantics to accessible interactive elements.

🎨 Contrast analysis: On the home page, all text and background combinations are checked for sufficient colour contrast so that content remains readable for users with low vision.

👁️ Colour blindness check: Also on the home page, we simulate how the page is perceived by people with various forms of colour blindness and whether information is conveyed by colour alone.

🧠 Heuristic checks: Experience-based rules detect context-sensitive barriers, such as navigation areas, forms or buttons without an accessible label that screen reader users cannot identify.

📐 Static checks: The source code is examined directly for objectively measurable errors, including duplicate IDs, broken ARIA references, incorrectly used aria-hidden, form issues, and CSS properties that impair reflow or text spacing.

📄 Every problem found is documented in the report:

🔍 Location in the source code: You see exactly where in the HTML the problem occurs.

💬 Message text: A concise description of the problem at a glance.

📝 Short explanation: What does this message mean in concrete terms?

🛠️ Extended guidance: A detailed description of the problem, its impact on affected user groups and concrete approaches to a solution.

🔗 Dedicated help page: Every problem links to a dedicated page with further information and code examples.

A website can be scanned as often as you like. The number of available scans depends on the package you choose. With Security-10 you can run 10 scans, and with Security-20 you can start 20 scans for any websites.

Yes! Simply send us a message at the address from which you received your customer access after ordering (or to our general support address). We will quickly send you a price quote and switch the package for you.

Of course, it is cheaper to choose the right package right away than to start small and upgrade shortly afterwards.

1. Customer account: We set up your customer account.
2. Link by email: You receive the link by email.
3. Add websites: In your customer area you can add websites whenever you like.
4. Scan: After you add a website, a scan starts.
5. Security report: You receive a detailed report with:
   • Findings and problems found
   • Concrete solution proposals
   • Recommendations for implementation
   • Explanations & guides

Our service is suitable for all kinds of websites:

• Company websites and online shops
• WordPress, Joomla, TYPO3 and other CMS
• Landing pages and microsites
• Blogs and portfolio sites
• Club and association websites

Requirements:

• The website must be publicly accessible (no password protection)
• No bot protection (if there is, we allow free re-scans)

We are happy to help:

• 📧 Email: service@it-logic.de
• 📞 Hotline: +49 6126 700 38 58

We are glad to help with questions about your order, the report or technical implementation.

🧠 Definition: Heuristic checks analyse a website according to known rules of thumb (heuristics). They detect typical patterns that experience shows create barriers for people with disabilities, without having to test the page fully by hand.

🎯 Goal: To automatically find common, well-documented problems that a simple rule check alone would not detect, e.g. whether an element is present but not given an accessible name.

🏷️ Missing accessible names: Navigation areas (<nav>), forms (<form>), page regions (<section>, <aside>) or embedded content (<iframe>) without a descriptive aria-label cannot be told apart by screen reader users, or are invisible to them.

🔘 Unlabelled buttons & input fields: Buttons without visible text or aria-label, and input fields without an associated label, cannot be read out meaningfully by assistive technologies.

🗺️ Unrecognised landmarks: Elements with role="region" or role="search" without an accessible name are simply ignored by screen readers.

📋 WCAG 4.1.2 – Name, Role, Value: All controls and structural elements must have a recognisable name and an unambiguous role for assistive technologies.

📋 WCAG 1.3.1 – Info and Relationships: The structure and meaning of content must also be programmatically determinable, i.e. without visual perception, e.g. through correct landmark markup of forms and page regions.

⚙️ Simple rule checks are binary: "Is an alt attribute present? Yes/No."

🧩 Heuristic checks go one step further: they consider the context, e.g. whether several <nav> elements exist on a page and therefore need distinguishable labels, or whether a button really has no accessible name even though it contains an icon.

🛠️ Concrete solution proposals: For every detected problem, a heuristic check provides directly actionable code fixes, for example adding aria-label="Main navigation", linking a label to an input field via for/id, or hiding purely decorative elements with aria-hidden="true".

✅ No interpretation needed: The results are prepared so that developers can implement the corrections directly in the code, without deep WCAG knowledge.

📐 Definition: Static checks analyse the HTML and CSS source code of a page directly, without running it in a browser. They look for clearly defined, objectively measurable patterns that demonstrably violate accessibility standards.

🎯 Strength: These checks deliver unambiguous yes/no results and can be fully automated. They form the foundation of any serious accessibility analysis.

🆔 Structural HTML errors: Duplicate IDs in the document or deprecated HTML elements can cause assistive technologies to misinterpret content or not find it at all.

🔗 Broken ARIA references: If aria-labelledby or aria-describedby points to an ID that does not exist in the document, the element remains without an accessible name for screen readers.

🚫 Incorrectly used aria-hidden: If aria-hidden="true" is set on focusable elements or even on <body>, content disappears completely for keyboard and screen reader users.

📋 Form problems: Radio and checkbox groups without <fieldset>/<legend>, input fields with autocomplete enabled for sensitive data, or generic link texts such as "click here" are common, easily fixed barriers.

🎨 Yes, stylesheets are checked as well: Certain CSS properties can directly violate accessibility criteria.

↔️ Reflow (WCAG 1.4.10): Excessive min-width values or overflow-x: scroll force users to scroll horizontally, which is a considerable problem for people with visual impairments who zoom in heavily.

📏 Text spacing (WCAG 1.4.12): Fixed heights on containers cause text to be cut off as soon as users apply their own text spacing settings.

📐 Static = rule-based & unambiguous: A problem such as "duplicate ID" or "missing <legend>" is either present or not. There is no room for interpretation.

🧠 Heuristic = context-sensitive: Heuristic checks assess whether an element forms a barrier in combination with other elements, for example whether a <nav> exists but cannot be told apart on a page with three other navs.

🤝 Complete together: Only the combination of both methods produces a reliable accessibility analysis.

⚠️ No, and it is important to know this: Static checks reliably detect all violations that can be checked automatically. According to estimates, that is about 30–40% of all possible WCAG problems.

🔎 What they do not detect: Whether an alt text makes sense in terms of content, whether the reading order seems logical, or whether operating sequences are truly intuitive for keyboard users. This requires additional heuristic analysis or manual testing.

Term: The contract initially runs for one year.

Cancellation: You can cancel up to one month before the end of the term. Without cancellation, the contract renews automatically for a further year at a time.

💡 Fair and transparent: no hidden clauses and no automatic renewals without a way to cancel.

No, not at all!

• You do not need to understand any technical details
• The security report contains explanations, guides and help texts
• Concrete recommendations for action instead of jargon
• Our support is available if you have questions

We are happy to offer you a lower price. Request an individual quote: service@it-logic.de

💼 We support non-profit work!